Cannot parsing when using \t tokenizer

----------------------- Option ---------------------------------
[inputs.logparser.grok]
custom_patterns = “TEST_TIMESTAMP %{YEAR}/%{MONTHDAY}/%{MONTHNUM},%{TIME}”
patterns = [’%{TEST_TIMESTAMP:timestamp:ts-“2006/02/01,15:04:05”}\t%{WORD:value}’]

----------------------------Log Sample--------------------------------------------------------------

2018/03/13,10:54:47 POST


i recieve message this ( 2018-04-26T00:33:00Z D! Grok no match found for: “2018/03/13,10:54:47\tPOST” )

can you help me??

If you use a single quote string in the TOML then most of the escape sequences are disabled, so '\t' matches a literal backslash followed by t, not a tab character. Maybe switch to using triple quote: """?

Details are here: https://github.com/toml-lang/toml#string

1 Like

thank you. i was done this issue